# Uncovering a crazy privilege escalation from Chrome extensions

filesystem:chrome://file-manager/external URLs rendered attacker HTML on a privileged chrome:// origin, letting a downloads-only extension read/write user files and reach fileManagerPrivate.

- Payout: $10,000
- Severity: high
- Program: Google VRP
- Credited: Derin Eryilmaz
- Disclosed: 2023-11-14
- CVE: CVE-2023-4369
- Write-up quality: 9/10
- Original: https://0x44.xyz/blog/cve-2023-4369/
- Library page: https://bugbountylibrary.com/r/blog%3A0x44-xyz-blog-cve-2023-4369
- Tags: domain:browser impact:data-leak impact:integrity impact:privesc kind:bounty platform:blog sev:high tech:chromium technique:chained technique:source-review vuln:access-control vuln:privilege-escalation vuln:xss

**Target:** chrome://file-manager and Image Loader component extension filesystem: /external URLs
**Root cause:** The legacy File System API /external path on chrome://file-manager and chrome-extension:// Image Loader origins serves user files as renderable HTML with no CSP; WebUIConfig change made filesystem:chrome:// URLs count as real Chrome origins with Mojo/chrome.send access.
**Steps:**
1. Extension with only `downloads` permission downloads a malicious `file.html` containing `<script>alert(1)</script>`
2. Extension reads `filename` from chrome.downloads to obtain the ChromeOS user hash (e.g. `878f28a3...`)
3. Extension opens `filesystem:chrome://file-manager/external/Downloads-<hash>/file.html`
4. Script executes on chrome://file-manager origin; XHR can fetch `chrome://prefs-internals` and relative downloaded files
5. For full chrome://file-manager: page runs `let fmWindow = window.open("javascript:0")` to get an uninitialized renderer
6. Extension calls `chrome.tabs.update()` to redirect that tab to `view-source:chrome://file-manager`
7. Same-origin reference `fmWindow.chrome.fileManagerPrivate` now exposes the private API
8. Use fileManagerPrivate to read/write downloads, set up Crostini, write `.bashrc`, and `openURL('chrome-untrusted://terminal')` to execute code
**How found:** Noticed a filesystem:chrome://file-manager/external URL in localStorage while poking at the File Manager, tried opening it, saw it rendered downloads; hypothesized HTML would render on a chrome:// origin, tested a script tag and it executed. Then probed devtools for Mojo/chrome.send and XHR to chrome://prefs-internals, and later read File Manager source to find the Image Loader sister bug.
**Exploitation:** A malicious extension needing only the downloads permission downloads an HTML payload, derives the user hash from the download path, and navigates to the filesystem:chrome://file-manager/external URL, achieving XSS on a privileged origin. Chaining window.open('javascript:0') with chrome.tabs.update to view-source:chrome://file-manager yields a same-origin handle to the real File Manager and its fileManagerPrivate API, enabling file read/write (ransomware), camera/mic access, and persistent code execution in the Crostini Linux container via .bashrc and chrome-untrusted://terminal. No user interaction.
**Escalation:** From XSS on filesystem: URL to full chrome://file-manager origin via uninitialized-renderer window.open + tabs.update redirect, unlocking fileManagerPrivate (85 functions) and Crostini terminal code execution; sister bug on Image Loader extension reached chrome://resources origin.
**Insight:** Legacy filesystem:/blob: schemes combined with chrome:// or chrome-extension:// origins can inherit privileged origin semantics; check whether obsolete storage APIs still serve user-controlled files as renderable HTML, and use window.open('javascript:0') plus tabs.update to view-source: to obtain same-origin handles to app-mode chrome:// pages.